Security of AI: The Convergence of AI Governance, Security and Assurance

Artificial intelligence is no longer a future technology waiting at the edge of enterprise adoption. It is already embedded in business operations, government missions, national security environments, healthcare systems, financial platforms, customer service functions, knowledge management tools, autonomous workflows, and decision-support systems. AI systems now recommend, generate, classify, summarize, predict, automate, and increasingly act on behalf of organizations.But as AI becomes more powerful, more autonomous, and more deeply integrated into critical operations, one question becomes unavoidable:Can these systems be governed, defended, tested, monitored, and trusted?Security of AI: A Practical Strategy to Governing, Defending, and Assuring Artificial Intelligence Systems provides a practical philosophy and operational framework for answering that question.This book argues that trustworthy AI cannot be achieved through ethics statements, cybersecurity controls, vendor claims, or compliance checklists alone. AI introduces a new category of risk because it is probabilistic, data-dependent, emergent, opaque, and vulnerable to adversarial manipulation. AI systems can hallucinate, leak sensitive information, amplify bias, drift over time, misinterpret instructions, follow malicious prompts, expose supply chain weaknesses, and produce high-confidence errors in mission-critical contexts.Traditional software security is necessary, but it is not enough.The central thesis of this book is simple:Trustworthy AI requires the convergence of governance, security, and assurance.Governance defines what the AI system is allowed to do, who is responsible for it, what outcomes are acceptable, and how risk decisions are made. Security protects AI systems from misuse, manipulation, compromise, adversarial attack, data poisoning, prompt injection, model theft, supply chain exposure, and operational failure. Assurance provides the evidence that the AI system performs as intended, remains aligned with policy, and continues to be trustworthy after deployment.Together, these three functions form the Security of AI philosophy:Govern. Defend. Prove.This book is written for leaders, practitioners, engineers, cybersecurity professionals, AI governance teams, acquisition professionals, auditors, risk managers, policymakers, data scientists, compliance teams, and technical decision-makers who must make AI real inside organizations. It is especially useful for those responsible for building AI governance programs, evaluating AI systems, managing AI portfolios, securing AI-enabled workflows, preparing AI assurance evidence, or integrating AI risk into enterprise risk management.The book begins by explaining why AI security matters and why AI systems differ from traditional software. AI is not merely code. It is a decision engine, an automation layer, and a knowledge interface. It influences people, operations, policies, markets, infrastructure, and missions. Because AI systems learn from data, infer patterns, generate outputs, and interact with users in natural language, they fail in ways that conventional IT systems do not.From there, the book defines the Security of AI philosophy and distinguishes it from adjacent disciplines such as cybersecurity, AI ethics, compliance, data science, and AI safety. Each of these fields contributes something important, but none is sufficient by itself. Security of AI is presented as an integrated discipline that connects policy, technical defense, validation, monitoring, auditability, and accountability across the AI lifecycle.A major theme throughout the book is the use of the NIST AI Risk Management Framework as the operational engine for Security of AI. The framework’s core functions—Govern, Map, Measure, and Manage—are used to translate high-level principles into practical activities. Read more